@kilterset/auth0-actions-testing
Version:
Test and develop Auth0 Actions or Okta CIC Actions locally.
218 lines • 11 kB
JavaScript
;
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const node_test_1 = __importDefault(require("node:test"));
const redirect_1 = require("../../mock/api/redirect");
const mock_1 = require("../../mock");
const node_assert_1 = require("node:assert");
const jwt_1 = require("../../jwt");
(0, node_test_1.default)("redirect", (t) => __awaiter(void 0, void 0, void 0, function* () {
const baseApi = Symbol("Base API");
yield t.test("encodeToken", (t) => __awaiter(void 0, void 0, void 0, function* () {
const now = new Date("2024-01-01T00:00:00.000Z");
const nowUnixTimestamp = now.getTime() / 1000;
const request = (0, mock_1.request)({
hostname: "example.com",
ip: "d666:171e:e7a4:1aa3:359a:a317:9f53:ee97",
});
const user = (0, mock_1.user)({ user_id: "auth0|8150" });
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
const token = api.encodeToken({
expiresInSeconds: 42,
payload: { foo: "bar" },
secret: "shh",
});
const [header, payload, signature] = token.split(".");
const decodedHeader = JSON.parse(atob(header));
const decodedPayload = JSON.parse(atob(payload));
(0, node_assert_1.deepStrictEqual)(decodedHeader, { alg: "HS256", typ: "JWT" }, "unexpected JWT header");
(0, node_assert_1.deepStrictEqual)(decodedPayload, {
iss: "example.com",
iat: nowUnixTimestamp,
exp: nowUnixTimestamp + 42,
sub: "auth0|8150",
ip: "d666:171e:e7a4:1aa3:359a:a317:9f53:ee97",
foo: "bar",
}, "unexpected claims");
(0, node_assert_1.strictEqual)(signature, "ZlLKLk7uJzDjD0nt2a08QiWMY1EPnhFIuc8WsSZPBvQ", "invalid signature");
}));
yield t.test("sendUserTo", (t) => __awaiter(void 0, void 0, void 0, function* () {
yield t.test("simple redirect", (t) => __awaiter(void 0, void 0, void 0, function* () {
const now = new Date();
const request = (0, mock_1.request)();
const user = (0, mock_1.user)();
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
(0, node_assert_1.strictEqual)(api.sendUserTo("https://example.com/r"), baseApi);
(0, node_assert_1.ok)(state.target, "redirect not set");
(0, node_assert_1.deepStrictEqual)(state.target.queryParams, {}, "query should be empty");
(0, node_assert_1.strictEqual)(state.target.url.href, "https://example.com/r", "url mismatch");
}));
yield t.test("redirect with consolidated GET parameters", (t) => __awaiter(void 0, void 0, void 0, function* () {
const now = new Date();
const request = (0, mock_1.request)();
const user = (0, mock_1.user)();
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
(0, node_assert_1.strictEqual)(api.sendUserTo("https://example.com?bread=rye", {
query: { filling: "cheese", spread: "butter" },
}), baseApi);
(0, node_assert_1.ok)(state.target, "redirect not set");
(0, node_assert_1.deepStrictEqual)(state.target.queryParams, { bread: "rye", filling: "cheese", spread: "butter" }, "unexpected query");
(0, node_assert_1.strictEqual)(state.target.url.href, "https://example.com/?bread=rye&filling=cheese&spread=butter", "url mismatch");
}));
}));
yield t.test("validateToken", (t) => __awaiter(void 0, void 0, void 0, function* () {
const VALID_SECRET = "shh";
const TOKEN_PAYLOAD = {
sub: "auth0|7321",
iss: "myapp.com",
iat: 1711509300,
exp: 1711509800,
state: "opaque-random-state",
foo: "bar",
};
const VALID_STATE = TOKEN_PAYLOAD.state;
const VALID_TOKEN = (0, jwt_1.encodeHS256JWT)({
secret: VALID_SECRET,
claims: TOKEN_PAYLOAD,
});
const VALID_CONTEXT = {
now: TOKEN_PAYLOAD.iat * 1000,
user: (0, mock_1.user)({ user_id: TOKEN_PAYLOAD.sub }),
request: (0, mock_1.request)({
method: "POST",
body: {
session_token: VALID_TOKEN,
state: VALID_STATE,
},
}),
};
yield t.test("decodes a valid POST token", (t) => __awaiter(void 0, void 0, void 0, function* () {
const { now, user } = VALID_CONTEXT;
const request = (0, mock_1.request)({
method: "POST",
body: {
session_token: VALID_TOKEN,
state: VALID_STATE,
},
});
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
const payload = api.validateToken({ secret: VALID_SECRET });
(0, node_assert_1.deepStrictEqual)(payload, TOKEN_PAYLOAD, "unexpected payload");
}));
yield t.test("decodes a valid GET token", (t) => __awaiter(void 0, void 0, void 0, function* () {
const { now, user } = VALID_CONTEXT;
const request = (0, mock_1.request)({
method: "GET",
query: {
session_token: VALID_TOKEN,
state: VALID_STATE,
},
});
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
const payload = api.validateToken({ secret: VALID_SECRET });
(0, node_assert_1.deepStrictEqual)(payload, TOKEN_PAYLOAD, "unexpected payload");
}));
yield t.test("can use an alternative parameter", (t) => __awaiter(void 0, void 0, void 0, function* () {
const { now, user } = VALID_CONTEXT;
const request = (0, mock_1.request)({
method: "POST",
body: {
a_token_param: VALID_TOKEN,
state: VALID_STATE,
},
});
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", {
now,
request,
user,
});
const api = build(baseApi);
const payload = api.validateToken({
secret: VALID_SECRET,
tokenParameterName: "a_token_param",
});
(0, node_assert_1.deepStrictEqual)(payload, TOKEN_PAYLOAD, "unexpected payload");
}));
yield t.test("throws error if state is mismatched", (t) => __awaiter(void 0, void 0, void 0, function* () {
const context = structuredClone(VALID_CONTEXT);
context.request.body.state = "mismatched-from-token-value";
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", context);
const api = build(baseApi);
(0, node_assert_1.throws)(() => api.validateToken({ secret: VALID_SECRET }), /state in the token/i);
}));
yield t.test("throws error if param is missing", (t) => __awaiter(void 0, void 0, void 0, function* () {
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", VALID_CONTEXT);
const api = build(baseApi);
(0, node_assert_1.throws)(() => api.validateToken({
secret: VALID_SECRET,
tokenParameterName: "a_token_param",
}), /no parameter called 'a_token_param'/i);
}));
yield t.test("throws error if expired", (t) => __awaiter(void 0, void 0, void 0, function* () {
const { user, request } = VALID_CONTEXT;
const now = TOKEN_PAYLOAD.exp * 1000; // exactly the expiry time
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", Object.assign(Object.assign({}, VALID_CONTEXT), { now }));
const api = build(baseApi);
(0, node_assert_1.throws)(() => api.validateToken({ secret: VALID_SECRET }), /expired/i);
}));
yield t.test("throws error if signature is invalid", (t) => __awaiter(void 0, void 0, void 0, function* () {
const context = structuredClone(VALID_CONTEXT);
context.request.body.session_token = VALID_TOKEN.replace(/\.[^.]+$/, ".badsignature");
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", context);
const api = build(baseApi);
(0, node_assert_1.throws)(() => api.validateToken({ secret: VALID_SECRET }), /signature/i);
}));
for (const claim of ["sub", "iss", "iat", "exp"]) {
yield t.test(`throws error if ${claim} is missing`, (t) => __awaiter(void 0, void 0, void 0, function* () {
const context = structuredClone(VALID_CONTEXT);
const claims = structuredClone(TOKEN_PAYLOAD);
(0, node_assert_1.ok)(claim in claims, "claim not in payload");
delete claims[claim];
context.request.body.session_token = (0, jwt_1.encodeHS256JWT)({
secret: VALID_SECRET,
claims,
});
const { build, state } = (0, redirect_1.redirectMock)("Another Flow", context);
const api = build(baseApi);
(0, node_assert_1.throws)(() => api.validateToken({ secret: VALID_SECRET }), /missing or invalid standard claims/i);
}));
}
}));
}));
//# sourceMappingURL=redirect.test.js.map